# Audit Auth

Audit authentication and session-management code for common issues, weak JWT config...

- Repository: https://github.com/vigolium/vigolium (1141 stars)
- Category: Engineering
- License: MIT
- Last updated: 2026-10-25
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add vigolium/vigolium --skill audit-auth -g -a claude-code -y`
Codex: `npx skills add vigolium/vigolium --skill audit-auth -g -a codex -y`
Cursor: `npx skills add vigolium/vigolium --skill audit-auth -g -a cursor -y`
Gemini CLI: `npx skills add vigolium/vigolium --skill audit-auth -g -a gemini-cli -y`

## Description

Audit authentication and session-management code for common issues, weak JWT config, session fixation, password-handling flaws, insecure cookies, broken OAuth flows, and missing auth checks on routes. Use when the user asks to review auth code or when source-aware scanning targets login/session/token handling.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Authentication & Session Code Audit

You are auditing authentication and session-management code. Your goal is
to identify concrete, reproducible vulnerabilities, not style nits. Each
issue you raise must map to a CWE and a specific file + line range, and
must be persisted via the `report_finding` tool.

## Scope, what to look for

Work through these in order; some targets will be irrelevant (skip and
say so in your final summary rather than fabricating findings):

### 1. JWT / token handling
- `alg=none` accepted by the verifier (CWE-327)
- Secret reused for HMAC and RSA (key confusion, CWE-347)
- Hard-coded secrets or secrets pulled from non-secret sources
- Missing `iss`, `aud`, `exp` validation (CWE-345)
- Tokens logged at INFO level (CWE-532)

### 2. Session management
- Session IDs derived from user input or predictable sources (CWE-330)
- No session rotation on privilege change (CWE-384 session fixation)
- Cookies missing `HttpOnly`, `Secure`, or `SameSite` (CWE-1004)
- Long or unbounded session lifetime

### 3. Password handling
- Plaintext storage or fast hashes (MD5/SHA1/SHA256 without KDF) (CWE-916)
- Passwords in URL query strings, logs, or error messages
- Timing-unsafe comparison of password hashes (CWE-208)
- No rate limiting on login (CWE-307)

### 4. OAuth / OIDC
- Missing `state` / PKCE (CWE-352 CSRF on auth flow)
- Open redirect on callback (CWE-601)
- `redirect_uri` not validated against allowlist
- Token exposure via referer or fragment-in-GET

### 5. Route-level auth
- Handlers that forget to call the auth middleware
- Role checks on client-supplied fields (e.g., trusting `req.body.role`)
- IDOR: authorization based on URL param without ownership check (CWE-639)

## Recommended workflow

The rest: https://github.com/vigolium/vigolium/blob/HEAD/internal/resources/olium/skills/audit-auth/SKILL.md